/*     */ package com.zimbra.cs.service.admin;
/*     */ 
/*     */ import com.google.common.base.Joiner;
/*     */ import com.zimbra.common.account.Key.AccountBy;
/*     */ import com.zimbra.common.account.Key.CalendarResourceBy;
/*     */ import com.zimbra.common.account.Key.DistributionListBy;
/*     */ import com.zimbra.common.account.Key.DomainBy;
/*     */ import com.zimbra.common.account.Key.ServerBy;
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.soap.Element;
/*     */ import com.zimbra.common.util.EmailUtil;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.AccessManager;
/*     */ import com.zimbra.cs.account.AccessManager.AttrRightChecker;
/*     */ import com.zimbra.cs.account.Account;
/*     */ import com.zimbra.cs.account.AccountServiceException;
/*     */ import com.zimbra.cs.account.AttributeClass;
/*     */ import com.zimbra.cs.account.AttributeManager;
/*     */ import com.zimbra.cs.account.AuthToken;
/*     */ import com.zimbra.cs.account.CalendarResource;
/*     */ import com.zimbra.cs.account.Cos;
/*     */ import com.zimbra.cs.account.DistributionList;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.DynamicGroup;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import com.zimbra.cs.account.NamedEntry;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ import com.zimbra.cs.account.Provisioning.Reasons;
/*     */ import com.zimbra.cs.account.Server;
/*     */ import com.zimbra.cs.account.accesscontrol.AdminRight;
/*     */ import com.zimbra.cs.account.accesscontrol.PseudoTarget;
/*     */ import com.zimbra.cs.account.accesscontrol.Rights.Admin;
/*     */ import com.zimbra.cs.account.accesscontrol.TargetType;
/*     */ import com.zimbra.cs.account.names.NameUtil.EmailAddress;
/*     */ import com.zimbra.cs.session.Session.Type;
/*     */ import com.zimbra.soap.DocumentHandler;
/*     */ import com.zimbra.soap.ZimbraSoapContext;
/*     */ import java.util.HashSet;
/*     */ import java.util.List;
/*     */ import java.util.Map;
/*     */ import java.util.Set;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public abstract class AdminDocumentHandler
/*     */   extends DocumentHandler
/*     */   implements AdminRightCheckPoint
/*     */ {
/*     */   public boolean needsAuth(Map<String, Object> context)
/*     */   {
/*  69 */     return true;
/*     */   }
/*     */   
/*     */   public boolean needsAdminAuth(Map<String, Object> context)
/*     */   {
/*  74 */     return true;
/*     */   }
/*     */   
/*     */   public boolean isAdminCommand()
/*     */   {
/*  79 */     return true;
/*     */   }
/*     */   
/*  82 */   protected String[] getProxiedAccountPath() { return null; }
/*  83 */   protected String[] getProxiedAccountElementPath() { return null; }
/*  84 */   protected String[] getProxiedResourcePath() { return null; }
/*  85 */   protected String[] getProxiedResourceElementPath() { return null; }
/*  86 */   protected String[] getProxiedServerPath() { return null; }
/*     */   
/*     */   protected Account getAccount(Provisioning prov, Key.AccountBy accountBy, String value, AuthToken authToken) throws ServiceException {
/*  89 */     Account acct = null;
/*     */     
/*     */     try
/*     */     {
/*  93 */       acct = prov.get(accountBy, value, true, authToken);
/*     */     }
/*     */     catch (ServiceException e) {
/*  96 */       acct = prov.get(accountBy, value, false, authToken);
/*     */     }
/*  98 */     return acct;
/*     */   }
/*     */   
/*     */   private CalendarResource getCalendarResource(Provisioning prov, Key.CalendarResourceBy crBy, String value) throws ServiceException {
/* 102 */     CalendarResource cr = null;
/*     */     
/*     */     try
/*     */     {
/* 106 */       cr = prov.get(crBy, value, true);
/*     */     }
/*     */     catch (ServiceException e) {
/* 109 */       cr = prov.get(crBy, value, false);
/*     */     }
/* 111 */     return cr;
/*     */   }
/*     */   
/*     */   public static Entry pseudoTargetInSameDomainAsEmail(TargetType targetType, String emailAddr) {
/* 115 */     String[] parts = EmailUtil.getLocalPartAndDomain(emailAddr);
/* 116 */     if ((parts == null) || (parts.length < 2)) {
/* 117 */       return null;
/*     */     }
/* 119 */     String domainStr = parts[1];
/*     */     try {
/* 121 */       return PseudoTarget.createPseudoTarget(Provisioning.getInstance(), targetType, Key.DomainBy.name, domainStr, false, null, null);
/*     */     }
/*     */     catch (ServiceException e) {}
/* 124 */     return null;
/*     */   }
/*     */   
/*     */ 
/*     */   protected void defendAgainstAccountHarvestingWhenAbsent(Key.AccountBy by, String selectorKey, ZimbraSoapContext zsc, AccountHarvestingChecker checker)
/*     */     throws ServiceException
/*     */   {
/* 131 */     AuthToken authToken = zsc.getAuthToken();
/* 132 */     if (authToken.isAdmin()) {
/* 133 */       throw AccountServiceException.NO_SUCH_ACCOUNT(selectorKey);
/*     */     }
/* 135 */     if ((Key.AccountBy.name.equals(by)) && (AuthToken.isAnyAdmin(authToken))) {
/* 136 */       Entry pseudoTarget = pseudoTargetInSameDomainAsEmail(TargetType.account, selectorKey);
/* 137 */       if (pseudoTarget != null) {
/* 138 */         checker.check((Account)pseudoTarget, selectorKey);
/* 139 */         throw AccountServiceException.NO_SUCH_ACCOUNT(selectorKey);
/*     */       }
/*     */     }
/*     */     
/* 143 */     throw ServiceException.DEFEND_ACCOUNT_HARVEST(selectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstAccountHarvesting(Account account, Key.AccountBy by, String selectorKey, ZimbraSoapContext zsc, AccountHarvestingChecker checker)
/*     */     throws ServiceException
/*     */   {
/* 149 */     if (account == null) {
/* 150 */       defendAgainstAccountHarvestingWhenAbsent(by, selectorKey, zsc, checker);
/* 151 */       return;
/*     */     }
/* 153 */     checker.check(account, selectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstAccountHarvestingWhenAbsent(Key.AccountBy by, String selectorKey, ZimbraSoapContext zsc, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 159 */     defendAgainstAccountHarvestingWhenAbsent(by, selectorKey, zsc, new AccountHarvestingCheckerUsingCheckAccountRight(zsc, needed));
/*     */   }
/*     */   
/*     */ 
/*     */   protected void defendAgainstAccountHarvesting(Account account, Key.AccountBy by, String selectorKey, ZimbraSoapContext zsc, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 166 */     AccountHarvestingCheckerUsingCheckAccountRight checker = new AccountHarvestingCheckerUsingCheckAccountRight(zsc, needed);
/*     */     
/* 168 */     if (account == null) {
/* 169 */       defendAgainstAccountHarvestingWhenAbsent(by, selectorKey, zsc, checker);
/* 170 */       return;
/*     */     }
/* 172 */     checker.check(account, selectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstAccountOrCalendarResourceHarvestingWhenAbsent(Key.AccountBy accountBy, String selectorKey, ZimbraSoapContext zsc, AdminRight rightForAcct, AdminRight rightForCalRes) throws ServiceException
/*     */   {
/*     */     try
/*     */     {
/* 179 */       Key.CalendarResourceBy calResBy = Key.CalendarResourceBy.fromString(accountBy.toString());
/* 180 */       defendAgainstCalResourceHarvestingWhenAbsent(calResBy, selectorKey, zsc, new CalResourceHarvestingCheckerUsingCheckCalendarResourceRight(zsc, rightForCalRes));
/*     */     }
/*     */     catch (ServiceException e) {
/* 183 */       defendAgainstAccountHarvestingWhenAbsent(accountBy, selectorKey, zsc, rightForAcct);
/*     */     }
/*     */   }
/*     */   
/*     */   protected void defendAgainstAccountOrCalendarResourceHarvesting(Account account, Key.AccountBy accountBy, String selectorKey, ZimbraSoapContext zsc, AdminRight rightForAcct, AdminRight rightForCalRes)
/*     */     throws ServiceException
/*     */   {
/* 190 */     if (account == null) {
/* 191 */       defendAgainstAccountOrCalendarResourceHarvestingWhenAbsent(accountBy, selectorKey, zsc, rightForAcct, rightForCalRes);
/*     */     }
/* 193 */     else if (account.isCalendarResource()) {
/* 194 */       Provisioning prov = Provisioning.getInstance();
/* 195 */       CalendarResource resource = prov.get(Key.CalendarResourceBy.id, account.getId());
/* 196 */       Key.CalendarResourceBy calResBy = Key.CalendarResourceBy.fromString(accountBy.toString());
/* 197 */       defendAgainstCalResourceHarvesting(resource, calResBy, selectorKey, zsc, rightForCalRes);
/*     */     } else {
/* 199 */       defendAgainstAccountHarvesting(account, accountBy, selectorKey, zsc, rightForAcct);
/*     */     }
/*     */   }
/*     */   
/*     */   protected void defendAgainstCalResourceHarvestingWhenAbsent(Key.CalendarResourceBy by, String selectorKey, ZimbraSoapContext zsc, CalResourceHarvestingChecker checker)
/*     */     throws ServiceException
/*     */   {
/* 206 */     AuthToken authToken = zsc.getAuthToken();
/* 207 */     if (authToken.isAdmin()) {
/* 208 */       throw AccountServiceException.NO_SUCH_CALENDAR_RESOURCE(selectorKey);
/*     */     }
/* 210 */     if ((Key.CalendarResourceBy.name.equals(by)) && (AuthToken.isAnyAdmin(authToken))) {
/* 211 */       Entry pseudoTarget = pseudoTargetInSameDomainAsEmail(TargetType.calresource, selectorKey);
/* 212 */       if (pseudoTarget != null) {
/* 213 */         checker.check((CalendarResource)pseudoTarget, selectorKey);
/* 214 */         throw AccountServiceException.NO_SUCH_CALENDAR_RESOURCE(selectorKey);
/*     */       }
/*     */     }
/*     */     
/* 218 */     throw ServiceException.DEFEND_CALENDAR_RESOURCE_HARVEST(selectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstCalResourceHarvesting(CalendarResource calRes, Key.CalendarResourceBy by, String selectorKey, ZimbraSoapContext zsc, CalResourceHarvestingChecker checker)
/*     */     throws ServiceException
/*     */   {
/* 224 */     if (calRes == null) {
/* 225 */       defendAgainstCalResourceHarvestingWhenAbsent(by, selectorKey, zsc, checker);
/* 226 */       return;
/*     */     }
/* 228 */     checker.check(calRes, selectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstCalResourceHarvesting(CalendarResource calRes, Key.CalendarResourceBy by, String selectorKey, ZimbraSoapContext zsc, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 234 */     CalResourceHarvestingCheckerUsingCheckCalendarResourceRight checker = new CalResourceHarvestingCheckerUsingCheckCalendarResourceRight(zsc, needed);
/*     */     
/* 236 */     if (calRes == null) {
/* 237 */       defendAgainstCalResourceHarvestingWhenAbsent(by, selectorKey, zsc, checker);
/* 238 */       return;
/*     */     }
/* 240 */     checker.check(calRes, selectorKey);
/*     */   }
/*     */   
/*     */   protected static abstract interface AccountHarvestingChecker {
/*     */     public abstract void check(Account paramAccount, String paramString) throws ServiceException;
/*     */   }
/*     */   
/*     */   protected abstract class AccountHarvestingCheckerBase implements AdminDocumentHandler.AccountHarvestingChecker {
/*     */     protected final ZimbraSoapContext zsc;
/*     */     protected final AuthToken authToken;
/* 250 */     protected ServiceException firstException = null;
/*     */     
/*     */     protected abstract void doRightsCheck(Account paramAccount) throws ServiceException;
/*     */     
/*     */     public AccountHarvestingCheckerBase(ZimbraSoapContext zsc) {
/* 255 */       this.zsc = zsc;
/* 256 */       this.authToken = zsc.getAuthToken();
/*     */     }
/*     */     
/*     */     protected boolean hasRight(Account account, String selectorKey) {
/*     */       try {
/* 261 */         doRightsCheck(account);
/* 262 */         return true;
/*     */       } catch (ServiceException se) {
/* 264 */         if (this.firstException == null) {
/* 265 */           if (this.authToken.isAdmin()) {
/* 266 */             this.firstException = se;
/*     */           } else
/* 268 */             this.firstException = ServiceException.DEFEND_ACCOUNT_HARVEST(selectorKey);
/*     */         }
/*     */       }
/* 271 */       return false;
/*     */     }
/*     */   }
/*     */   
/*     */   protected class AccountHarvestingCheckerUsingCheckAccountRight extends AdminDocumentHandler.AccountHarvestingCheckerBase
/*     */   {
/* 277 */     private Object needed = null;
/*     */     
/*     */     public AccountHarvestingCheckerUsingCheckAccountRight(ZimbraSoapContext zsc, Object needed) {
/* 280 */       super(zsc);
/* 281 */       this.needed = needed;
/*     */     }
/*     */     
/*     */     protected void doRightsCheck(Account account) throws ServiceException
/*     */     {
/* 286 */       AdminDocumentHandler.this.checkAccountRight(this.zsc, account, this.needed);
/*     */     }
/*     */     
/*     */     public void check(Account account, String selectorKey) throws ServiceException
/*     */     {
/* 291 */       if (hasRight(account, selectorKey)) {
/* 292 */         return;
/*     */       }
/* 294 */       throw this.firstException;
/*     */     }
/*     */   }
/*     */   
/*     */   protected class AccountHarvestingCheckerUsingCheckRight extends AdminDocumentHandler.AccountHarvestingCheckerBase
/*     */   {
/*     */     private final AdminRight adminRight;
/*     */     private final Map<String, Object> context;
/*     */     
/*     */     public AccountHarvestingCheckerUsingCheckRight(Map<String, Object> zsc, AdminRight context) {
/* 304 */       super(zsc);
/* 305 */       this.adminRight = right;
/* 306 */       this.context = context;
/*     */     }
/*     */     
/*     */     protected void doRightsCheck(Account account) throws ServiceException
/*     */     {
/* 311 */       AdminDocumentHandler.this.checkRight(this.zsc, this.context, account, this.adminRight);
/*     */     }
/*     */     
/*     */     public void check(Account account, String selectorKey) throws ServiceException
/*     */     {
/* 316 */       if (hasRight(account, selectorKey)) {
/* 317 */         return;
/*     */       }
/* 319 */       throw this.firstException;
/*     */     }
/*     */   }
/*     */   
/*     */   protected static abstract interface CalResourceHarvestingChecker {
/*     */     public abstract void check(CalendarResource paramCalendarResource, String paramString) throws ServiceException;
/*     */   }
/*     */   
/*     */   protected abstract class CalResourceHarvestingCheckerBase implements AdminDocumentHandler.CalResourceHarvestingChecker {
/*     */     protected final ZimbraSoapContext zsc;
/*     */     protected final AuthToken authToken;
/* 330 */     protected ServiceException firstException = null;
/*     */     
/*     */     protected abstract void doRightsCheck(CalendarResource paramCalendarResource) throws ServiceException;
/*     */     
/*     */     public CalResourceHarvestingCheckerBase(ZimbraSoapContext zsc) {
/* 335 */       this.zsc = zsc;
/* 336 */       this.authToken = zsc.getAuthToken();
/*     */     }
/*     */     
/*     */     protected boolean hasRight(CalendarResource calRes, String selectorKey) {
/*     */       try {
/* 341 */         doRightsCheck(calRes);
/* 342 */         return true;
/*     */       } catch (ServiceException se) {
/* 344 */         if (this.firstException == null) {
/* 345 */           if (this.authToken.isAdmin()) {
/* 346 */             this.firstException = se;
/*     */           } else
/* 348 */             this.firstException = ServiceException.DEFEND_CALENDAR_RESOURCE_HARVEST(selectorKey);
/*     */         }
/*     */       }
/* 351 */       return false;
/*     */     }
/*     */   }
/*     */   
/*     */   protected class CalResourceHarvestingCheckerUsingCheckCalendarResourceRight
/*     */     extends AdminDocumentHandler.CalResourceHarvestingCheckerBase
/*     */   {
/* 358 */     private Object needed = null;
/*     */     
/*     */     public CalResourceHarvestingCheckerUsingCheckCalendarResourceRight(ZimbraSoapContext zsc, Object needed)
/*     */     {
/* 362 */       super(zsc);
/* 363 */       this.needed = needed;
/*     */     }
/*     */     
/*     */     protected void doRightsCheck(CalendarResource calRes) throws ServiceException
/*     */     {
/* 368 */       AdminDocumentHandler.this.checkCalendarResourceRight(this.zsc, calRes, this.needed);
/*     */     }
/*     */     
/*     */     public void check(CalendarResource calRes, String selectorKey) throws ServiceException
/*     */     {
/* 373 */       if (hasRight(calRes, selectorKey)) {
/* 374 */         return;
/*     */       }
/* 376 */       throw this.firstException;
/*     */     }
/*     */   }
/*     */   
/*     */   protected static abstract interface GroupHarvestingChecker {
/*     */     public abstract void check(Group paramGroup, String paramString) throws ServiceException;
/*     */   }
/*     */   
/*     */   protected abstract class GroupHarvestingCheckerBase implements AdminDocumentHandler.GroupHarvestingChecker {
/*     */     protected final ZimbraSoapContext zsc;
/*     */     protected final AuthToken authToken;
/* 387 */     protected ServiceException firstException = null;
/*     */     
/*     */     protected abstract void doRightsCheck(Group paramGroup) throws ServiceException;
/*     */     
/*     */     public GroupHarvestingCheckerBase(ZimbraSoapContext zsc) {
/* 392 */       this.zsc = zsc;
/* 393 */       this.authToken = zsc.getAuthToken();
/*     */     }
/*     */     
/*     */     protected boolean hasRight(Group group, String selectorKey) {
/*     */       try {
/* 398 */         doRightsCheck(group);
/* 399 */         return true;
/*     */       } catch (ServiceException se) {
/* 401 */         if (this.firstException == null) {
/* 402 */           if (this.authToken.isAdmin()) {
/* 403 */             this.firstException = se;
/*     */           } else
/* 405 */             this.firstException = ServiceException.DEFEND_DL_HARVEST(selectorKey);
/*     */         }
/*     */       }
/* 408 */       return false;
/*     */     }
/*     */   }
/*     */   
/*     */   protected class GroupHarvestingCheckerUsingCheckGroupRight extends AdminDocumentHandler.GroupHarvestingCheckerBase
/*     */   {
/* 414 */     private Object needed = null;
/*     */     
/*     */     public GroupHarvestingCheckerUsingCheckGroupRight(ZimbraSoapContext zsc, Object needed) {
/* 417 */       super(zsc);
/* 418 */       this.needed = needed;
/*     */     }
/*     */     
/*     */     protected void doRightsCheck(Group group) throws ServiceException
/*     */     {
/* 423 */       if (group.isDynamic()) {
/* 424 */         AdminDocumentHandler.this.checkDynamicGroupRight(this.zsc, (DynamicGroup)group, this.needed);
/*     */       } else {
/* 426 */         AdminDocumentHandler.this.checkDistributionListRight(this.zsc, (DistributionList)group, this.needed);
/*     */       }
/*     */     }
/*     */     
/*     */     public void check(Group group, String selectorKey) throws ServiceException
/*     */     {
/* 432 */       if (hasRight(group, selectorKey)) {
/* 433 */         return;
/*     */       }
/* 435 */       throw this.firstException;
/*     */     }
/*     */   }
/*     */   
/*     */   protected class GroupHarvestingCheckerUsingGetAttrsPerms extends AdminDocumentHandler.GroupHarvestingCheckerBase
/*     */   {
/*     */     private final AccessManager.AttrRightChecker arc;
/*     */     private final List<String> getAttrs;
/*     */     private String currAttr;
/*     */     
/*     */     public GroupHarvestingCheckerUsingGetAttrsPerms(AccessManager.AttrRightChecker zsc, List<String> arc) {
/* 446 */       super(zsc);
/* 447 */       this.arc = arc;
/* 448 */       this.getAttrs = getAttrs;
/*     */     }
/*     */     
/*     */     protected void doRightsCheck(Group group) throws ServiceException
/*     */     {
/* 453 */       if ((this.arc != null) && (!this.arc.allowAttr(this.currAttr))) {
/* 454 */         throw ServiceException.DEFEND_DL_HARVEST(group.getName());
/*     */       }
/*     */     }
/*     */     
/*     */     public void check(Group group, String selectorKey) throws ServiceException
/*     */     {
/* 460 */       for (String attr : this.getAttrs) {
/* 461 */         this.currAttr = attr;
/* 462 */         if (hasRight(group, selectorKey)) {
/* 463 */           return;
/*     */         }
/*     */       }
/* 466 */       throw this.firstException;
/*     */     }
/*     */   }
/*     */   
/*     */   protected class GroupHarvestingCheckerUsingCheckRight extends AdminDocumentHandler.GroupHarvestingCheckerBase
/*     */   {
/*     */     private final AdminRight adminRight;
/*     */     private final Map<String, Object> context;
/*     */     
/*     */     public GroupHarvestingCheckerUsingCheckRight(Map<String, Object> zsc, AdminRight context) {
/* 476 */       super(zsc);
/* 477 */       this.adminRight = right;
/* 478 */       this.context = context;
/*     */     }
/*     */     
/*     */     protected void doRightsCheck(Group group) throws ServiceException
/*     */     {
/* 483 */       AdminDocumentHandler.this.checkRight(this.zsc, this.context, group, this.adminRight);
/*     */     }
/*     */     
/*     */     public void check(Group group, String selectorKey) throws ServiceException
/*     */     {
/* 488 */       if (hasRight(group, selectorKey)) {
/* 489 */         return;
/*     */       }
/* 491 */       throw this.firstException;
/*     */     }
/*     */   }
/*     */   
/*     */   protected void defendAgainstGroupHarvestingWhenAbsent(Key.DistributionListBy dlBy, String groupSelectorKey, ZimbraSoapContext zsc, GroupHarvestingChecker checker)
/*     */     throws ServiceException
/*     */   {
/* 498 */     AuthToken authToken = zsc.getAuthToken();
/* 499 */     if (authToken.isAdmin()) {
/* 500 */       throw AccountServiceException.NO_SUCH_DISTRIBUTION_LIST(groupSelectorKey);
/*     */     }
/* 502 */     if ((Key.DistributionListBy.name.equals(dlBy)) && (AuthToken.isAnyAdmin(authToken))) {
/* 503 */       Entry pseudoTarget = pseudoTargetInSameDomainAsEmail(TargetType.dl, groupSelectorKey);
/* 504 */       if (pseudoTarget != null) {
/* 505 */         checker.check((DistributionList)pseudoTarget, groupSelectorKey);
/* 506 */         throw AccountServiceException.NO_SUCH_DISTRIBUTION_LIST(groupSelectorKey);
/*     */       }
/*     */     }
/*     */     
/* 510 */     throw ServiceException.DEFEND_DL_HARVEST(groupSelectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstGroupHarvesting(Group group, Key.DistributionListBy dlBy, String groupSelectorKey, ZimbraSoapContext zsc, GroupHarvestingChecker checker)
/*     */     throws ServiceException
/*     */   {
/* 516 */     if (group == null) {
/* 517 */       defendAgainstGroupHarvestingWhenAbsent(dlBy, groupSelectorKey, zsc, checker);
/* 518 */       return;
/*     */     }
/* 520 */     checker.check(group, groupSelectorKey);
/*     */   }
/*     */   
/*     */   protected void defendAgainstGroupHarvestingWhenAbsent(Key.DistributionListBy dlBy, String groupSelectorKey, ZimbraSoapContext zsc, AdminRight dlRight)
/*     */     throws ServiceException
/*     */   {
/* 526 */     defendAgainstGroupHarvestingWhenAbsent(dlBy, groupSelectorKey, zsc, new GroupHarvestingCheckerUsingCheckGroupRight(zsc, dlRight));
/*     */   }
/*     */   
/*     */ 
/*     */   protected void defendAgainstGroupHarvesting(Group group, Key.DistributionListBy dlBy, String groupSelectorKey, ZimbraSoapContext zsc, Object dynamicGroupNeeded, Object dlNeeded)
/*     */     throws ServiceException
/*     */   {
/* 533 */     if (group == null) {
/* 534 */       defendAgainstGroupHarvestingWhenAbsent(dlBy, groupSelectorKey, zsc, new GroupHarvestingCheckerUsingCheckGroupRight(zsc, dlNeeded));
/*     */       
/* 536 */       return;
/*     */     }
/* 538 */     GroupHarvestingCheckerUsingCheckGroupRight checker = new GroupHarvestingCheckerUsingCheckGroupRight(zsc, group.isDynamic() ? dynamicGroupNeeded : dlNeeded);
/*     */     
/* 540 */     checker.check(group, groupSelectorKey);
/*     */   }
/*     */   
/*     */   protected Element proxyIfNecessary(Element request, Map<String, Object> context)
/*     */     throws ServiceException
/*     */   {
/* 546 */     ZimbraSoapContext zsc = getZimbraSoapContext(context);
/* 547 */     if (zsc.getProxyTarget() != null) {
/* 548 */       return null;
/*     */     }
/*     */     try {
/* 551 */       Provisioning prov = Provisioning.getInstance();
/*     */       
/* 553 */       Provisioning.Reasons reasons = new Provisioning.Reasons();
/*     */       
/* 555 */       String[] xpath = getProxiedAccountPath();
/* 556 */       String acctId = xpath != null ? getXPath(request, xpath) : null;
/* 557 */       if (acctId != null) {
/* 558 */         Account acct = getAccount(prov, Key.AccountBy.id, acctId, zsc.getAuthToken());
/* 559 */         if ((acct != null) && (!Provisioning.onLocalServer(acct, reasons))) {
/* 560 */           if ((zsc.getHopCount() > 2) || (ZimbraLog.soap.isDebugEnabled())) {
/* 561 */             ZimbraLog.soap.info("Proxying request:ProxiedAccountPath=%s reasons:%s", new Object[] { Joiner.on("/").join(xpath), reasons.getReason() });
/*     */           }
/*     */           
/* 564 */           return proxyRequest(request, context, acctId);
/*     */         }
/*     */       }
/*     */       
/* 568 */       xpath = getProxiedAccountElementPath();
/* 569 */       Element acctElt = xpath != null ? getXPathElement(request, xpath) : null;
/* 570 */       if (acctElt != null) {
/* 571 */         Account acct = getAccount(prov, Key.AccountBy.fromString(acctElt.getAttribute("by")), acctElt.getText(), zsc.getAuthToken());
/*     */         
/* 573 */         if ((acct != null) && (!Provisioning.onLocalServer(acct, reasons))) {
/* 574 */           if ((zsc.getHopCount() > 2) || (ZimbraLog.soap.isDebugEnabled())) {
/* 575 */             ZimbraLog.soap.info("Proxying request:ProxiedAccountElementPath=%s acctElt=%s reasons:%s", new Object[] { Joiner.on("/").join(xpath), acctElt.toString(), reasons.getReason() });
/*     */           }
/*     */           
/* 578 */           return proxyRequest(request, context, acct.getId());
/*     */         }
/*     */       }
/*     */       
/*     */ 
/* 583 */       xpath = getProxiedResourcePath();
/* 584 */       String rsrcId = xpath != null ? getXPath(request, xpath) : null;
/* 585 */       if (rsrcId != null) {
/* 586 */         CalendarResource rsrc = getCalendarResource(prov, Key.CalendarResourceBy.id, rsrcId);
/* 587 */         if ((rsrc != null) && (!Provisioning.onLocalServer(rsrc, reasons))) {
/* 588 */           if ((zsc.getHopCount() > 2) || (ZimbraLog.soap.isDebugEnabled())) {
/* 589 */             ZimbraLog.soap.info("Proxying request:ProxiedResourcePath=%s rsrcId=%s reasons:%s", new Object[] { Joiner.on("/").join(xpath), rsrcId, reasons.getReason() });
/*     */           }
/*     */           
/* 592 */           return proxyRequest(request, context, rsrcId);
/*     */         }
/*     */       }
/*     */       
/* 596 */       xpath = getProxiedResourceElementPath();
/* 597 */       Element resourceElt = xpath != null ? getXPathElement(request, xpath) : null;
/* 598 */       if (resourceElt != null) {
/* 599 */         CalendarResource rsrc = getCalendarResource(prov, Key.CalendarResourceBy.fromString(resourceElt.getAttribute("by")), resourceElt.getText());
/*     */         
/* 601 */         if ((rsrc != null) && (!Provisioning.onLocalServer(rsrc, reasons))) {
/* 602 */           if ((zsc.getHopCount() > 2) || (ZimbraLog.soap.isDebugEnabled())) {
/* 603 */             ZimbraLog.soap.info("Proxying request:ProxiedResourceElementPath=%s resourceElt=%s reasons:%s", new Object[] { Joiner.on("/").join(xpath), resourceElt.toString(), reasons.getReason() });
/*     */           }
/*     */           
/* 606 */           return proxyRequest(request, context, rsrc.getId());
/*     */         }
/*     */       }
/*     */       
/*     */ 
/* 611 */       xpath = getProxiedServerPath();
/* 612 */       String serverId = xpath != null ? getXPath(request, xpath) : null;
/* 613 */       if (serverId != null) {
/* 614 */         Server server = prov.get(Key.ServerBy.id, serverId);
/* 615 */         if ((server != null) && (!getLocalHostId().equalsIgnoreCase(server.getId()))) {
/* 616 */           if ((zsc.getHopCount() > 2) || (ZimbraLog.soap.isDebugEnabled())) {
/* 617 */             ZimbraLog.soap.info("Proxying request:ProxiedServerPath=%s serverId=%s server=%s server ID=%s != localHostId=%s", new Object[] { Joiner.on("/").join(xpath), serverId, server.getName(), server.getId(), getLocalHostId() });
/*     */           }
/*     */           
/*     */ 
/* 621 */           return proxyRequest(request, context, server);
/*     */         }
/*     */       }
/*     */       
/* 625 */       return null;
/*     */     }
/*     */     catch (ServiceException e) {
/* 628 */       if ("service.PROXY_ERROR".equals(e.getCode())) {
/* 629 */         return null;
/*     */       }
/* 631 */       throw e;
/*     */     }
/*     */   }
/*     */   
/*     */   public Session.Type getDefaultSessionType()
/*     */   {
/* 637 */     return Session.Type.ADMIN;
/*     */   }
/*     */   
/*     */   protected Set<String> getReqAttrs(Element request, AttributeClass klass) throws ServiceException {
/* 641 */     String attrsStr = request.getAttribute("attrs", null);
/* 642 */     return getReqAttrs(attrsStr, klass);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   protected Set<String> getReqAttrs(String attrsStr, AttributeClass klass)
/*     */     throws ServiceException
/*     */   {
/* 659 */     if (attrsStr == null) {
/* 660 */       return null;
/*     */     }
/*     */     
/* 663 */     String[] attrs = attrsStr.split(",");
/*     */     
/* 665 */     Set<String> attrsOnEntry = AttributeManager.getInstance().getAllAttrsInClass(klass);
/* 666 */     Set<String> validAttrs = new HashSet();
/*     */     
/* 668 */     for (String attr : attrs) {
/* 669 */       if (attrsOnEntry.contains(attr)) {
/* 670 */         validAttrs.add(attr);
/*     */       } else {
/* 672 */         throw ServiceException.INVALID_REQUEST("requested attribute " + attr + " is not on " + klass.name(), null);
/*     */       }
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 680 */     return validAttrs;
/*     */   }
/*     */   
/*     */   public boolean isDomainAdminOnly(ZimbraSoapContext zsc) {
/* 684 */     return AccessManager.getInstance().isDomainAdminOnly(zsc.getAuthToken());
/*     */   }
/*     */   
/*     */   public Domain getAuthTokenAccountDomain(ZimbraSoapContext zsc) throws ServiceException {
/* 688 */     return AccessManager.getInstance().getDomain(zsc.getAuthToken());
/*     */   }
/*     */   
/*     */   protected boolean canAccessDomain(ZimbraSoapContext zsc, String domainName) throws ServiceException {
/* 692 */     return AccessManager.getInstance().canAccessDomain(zsc.getAuthToken(), domainName);
/*     */   }
/*     */   
/*     */   protected boolean canAccessDomain(ZimbraSoapContext zsc, Domain domain) throws ServiceException {
/* 696 */     return canAccessDomain(zsc, domain.getName());
/*     */   }
/*     */   
/*     */   protected boolean canModifyMailQuota(ZimbraSoapContext zsc, Account target, long mailQuota) throws ServiceException {
/* 700 */     return AccessManager.getInstance().canModifyMailQuota(zsc.getAuthToken(), target, mailQuota);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public boolean canAccessEmail(ZimbraSoapContext zsc, String email)
/*     */     throws ServiceException
/*     */   {
/* 713 */     return canAccessDomain(zsc, NameUtil.EmailAddress.getDomainNameFromEmail(email));
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public void checkModifyAttrs(ZimbraSoapContext zsc, AttributeClass attrClass, Map<String, Object> attrs)
/*     */     throws ServiceException
/*     */   {
/* 733 */     AdminAccessControl.getAdminAccessControl(zsc).checkModifyAttrs(attrClass, attrs);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   protected void checkSetAttrsOnCreate(ZimbraSoapContext zsc, TargetType targetType, String entryName, Map<String, Object> attrs)
/*     */     throws ServiceException
/*     */   {
/* 742 */     AdminAccessControl.getAdminAccessControl(zsc).checkSetAttrsOnCreate(targetType, entryName, attrs);
/*     */   }
/*     */   
/*     */   protected boolean hasRightsToList(ZimbraSoapContext zsc, NamedEntry target, AdminRight listRight, Object getAttrRight) throws ServiceException
/*     */   {
/* 747 */     return AdminAccessControl.getAdminAccessControl(zsc).hasRightsToList(target, listRight, getAttrRight);
/*     */   }
/*     */   
/*     */   protected boolean hasRightsToListCos(ZimbraSoapContext zsc, Cos target, AdminRight listRight, Object getAttrRight) throws ServiceException
/*     */   {
/* 752 */     return AdminAccessControl.getAdminAccessControl(zsc).hasRightsToListCos(target, listRight, getAttrRight);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkRight(ZimbraSoapContext zsc, Map<String, Object> context, Entry target, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 767 */     AccessManager am = AccessManager.getInstance();
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 773 */     if (AdminAccessControl.isDomainBasedAccessManager(am))
/*     */     {
/* 775 */       if ((isDomainAdminOnly(zsc)) && 
/* 776 */         (!domainAuthSufficient(context))) {
/* 777 */         throw ServiceException.PERM_DENIED("cannot access entry");
/*     */       }
/*     */       
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 784 */       return AdminAccessControl.getAdminAccessControl(zsc);
/*     */     }
/*     */     
/* 787 */     return checkRight(zsc, target, needed);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public static AdminAccessControl checkRight(ZimbraSoapContext zsc, Entry target, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 817 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 818 */     aac.checkRight(target, needed);
/* 819 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkCosRight(ZimbraSoapContext zsc, Cos cos, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 828 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 829 */     aac.checkCosRight(cos, needed);
/* 830 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkAccountRight(ZimbraSoapContext zsc, Account account, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 839 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 840 */     aac.checkAccountRight(this, account, needed);
/* 841 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkCalendarResourceRight(ZimbraSoapContext zsc, CalendarResource cr, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 850 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 851 */     aac.checkCalendarResourceRight(this, cr, needed);
/* 852 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkAdminLoginAsRight(ZimbraSoapContext zsc, Provisioning prov, Account account)
/*     */     throws ServiceException
/*     */   {
/* 860 */     if (account.isCalendarResource())
/*     */     {
/* 862 */       CalendarResource resource = prov.get(Key.CalendarResourceBy.id, account.getId());
/* 863 */       return checkCalendarResourceRight(zsc, resource, Rights.Admin.R_adminLoginCalendarResourceAs);
/*     */     }
/* 865 */     return checkAccountRight(zsc, account, Rights.Admin.R_adminLoginAs);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkDistributionListRight(ZimbraSoapContext zsc, DistributionList dl, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 876 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 877 */     aac.checkDistributionListRight(this, dl, needed);
/* 878 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkDynamicGroupRight(ZimbraSoapContext zsc, DynamicGroup group, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 889 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 890 */     aac.checkDynamicGroupRight(this, group, needed);
/* 891 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   protected AdminAccessControl checkDomainRightByEmail(ZimbraSoapContext zsc, String email, AdminRight needed)
/*     */     throws ServiceException
/*     */   {
/* 906 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 907 */     aac.checkDomainRightByEmail(this, email, needed);
/* 908 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */   protected AdminAccessControl checkDomainRight(ZimbraSoapContext zsc, String domainName, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 915 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 916 */     aac.checkDomainRight(this, domainName, needed);
/* 917 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */   protected AdminAccessControl checkDomainRight(ZimbraSoapContext zsc, Domain domain, Object needed)
/*     */     throws ServiceException
/*     */   {
/* 924 */     AdminAccessControl aac = AdminAccessControl.getAdminAccessControl(zsc);
/* 925 */     aac.checkDomainRight(this, domain, needed);
/* 926 */     return aac;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   protected void checkRightTODO() {}
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public void docRights(List<AdminRight> relatedRights, List<String> notes)
/*     */   {
/* 941 */     notes.add("TDB");
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/service/admin/AdminDocumentHandler.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */